'; } return $retval; } /** * Function to get html for the start row and number of rows panel * * @param string $sql_query sql query * * @return string html * * @throws Throwable * @throws LoaderError * @throws RuntimeError * @throws SyntaxError */ public static function getStartAndNumberOfRowsPanel($sql_query): string { $template = new Template(); if (isset($_REQUEST['session_max_rows'])) { $rows = $_REQUEST['session_max_rows']; } elseif (isset($_SESSION['tmpval']['max_rows']) && $_SESSION['tmpval']['max_rows'] !== 'all' ) { $rows = $_SESSION['tmpval']['max_rows']; } else { $rows = (int) $GLOBALS['cfg']['MaxRows']; $_SESSION['tmpval']['max_rows'] = $rows; } if (isset($_REQUEST['pos'])) { $pos = $_REQUEST['pos']; } elseif (isset($_SESSION['tmpval']['pos'])) { $pos = $_SESSION['tmpval']['pos']; } else { $number_of_line = (int) $_REQUEST['unlim_num_rows']; $pos = (ceil($number_of_line / $rows) - 1) * $rows; $_SESSION['tmpval']['pos'] = $pos; } return $template->render( 'start_and_number_of_rows_panel', [ 'pos' => $pos, 'unlim_num_rows' => (int) $_REQUEST['unlim_num_rows'], 'rows' => $rows, 'sql_query' => $sql_query, ] ); } /** * Execute an EXPLAIN query and formats results similar to MySQL command line * utility. * * @param string $sqlQuery EXPLAIN query * * @return string query results */ private static function generateRowQueryOutput($sqlQuery): string { global $dbi; $ret = ''; $result = $dbi->query($sqlQuery); if ($result) { $devider = '+'; $columnNames = '|'; $fieldsMeta = $dbi->getFieldsMeta($result); foreach ($fieldsMeta as $meta) { $devider .= '---+'; $columnNames .= ' ' . $meta->name . ' |'; } $devider .= "\n"; $ret .= $devider . $columnNames . "\n" . $devider; while ($row = $dbi->fetchRow($result)) { $values = '|'; foreach ($row as $value) { if ($value === null) { $value = 'NULL'; } $values .= ' ' . $value . ' |'; } $ret .= $values . "\n"; } $ret .= $devider; } return $ret; } /** * Prepare the message and the query * usually the message is the result of the query executed * * @param Message|string $message the message to display * @param string $sql_query the query to display * @param string $type the type (level) of the message * * @throws Throwable * @throws LoaderError * @throws RuntimeError * @throws SyntaxError * * @access public */ public static function getMessage( $message, $sql_query = null, $type = 'notice' ): string { global $cfg, $dbi; $retval = ''; if ($sql_query === null) { if (! empty($GLOBALS['display_query'])) { $sql_query = $GLOBALS['display_query']; } elseif (! empty($GLOBALS['unparsed_sql'])) { $sql_query = $GLOBALS['unparsed_sql']; } elseif (! empty($GLOBALS['sql_query'])) { $sql_query = $GLOBALS['sql_query']; } else { $sql_query = ''; } } $render_sql = $cfg['ShowSQL'] == true && ! empty($sql_query) && $sql_query !== ';'; if (isset($GLOBALS['using_bookmark_message'])) { $retval .= $GLOBALS['using_bookmark_message']->getDisplay(); unset($GLOBALS['using_bookmark_message']); } if ($render_sql) { $retval .= '
' . "\n";
}
if ($message instanceof Message) {
if (isset($GLOBALS['special_message'])) {
$message->addText($GLOBALS['special_message']);
unset($GLOBALS['special_message']);
}
$retval .= $message->getDisplay();
} else {
$context = 'primary';
if ($type === 'error') {
$context = 'danger';
} elseif ($type === 'success') {
$context = 'success';
}
$retval .= '
' . "\n" . ' . "'; $query_base = htmlspecialchars(addslashes($query_base)); $query_base = preg_replace( '/((\015\012)|(\015)|(\012))/', $new_line, $query_base ); $query_base = '
';
}
return $retval;
}
/**
* Displays a link to the PHP documentation
*
* @param string $target anchor in documentation
*
* @return string the html link
*
* @access public
*/
public static function showPHPDocumentation($target): string
{
return self::showDocumentationLink(Core::getPHPDocLink($target));
}
/**
* Displays a link to the documentation as an icon
*
* @param string $link documentation link
* @param string $target optional link target
* @param bool $bbcode optional flag indicating whether to output bbcode
*
* @return string the html link
*
* @access public
*/
public static function showDocumentationLink($link, $target = 'documentation', $bbcode = false): string
{
if ($bbcode) {
return '[a@' . $link . '@' . $target . '][dochelpicon][/a]';
}
return ''
. self::getImage('b_help', __('Documentation'))
. '';
}
/**
* Displays a MySQL error message in the main panel when $exit is true.
* Returns the error message otherwise.
*
* @param string|bool $server_msg Server's error message.
* @param string $sql_query The SQL query that failed.
* @param bool $is_modify_link Whether to show a "modify" link or not.
* @param string $back_url URL for the "back" link (full path is
* not required).
* @param bool $exit Whether execution should be stopped or
* the error message should be returned.
*
* @global string $table The current table.
* @global string $db The current database.
*
* @access public
*/
public static function mysqlDie(
$server_msg = '',
$sql_query = '',
$is_modify_link = true,
$back_url = '',
$exit = true
): ?string {
global $table, $db, $dbi;
/**
* Error message to be built.
*
* @var string $error_msg
*/
$error_msg = '';
// Checking for any server errors.
if (empty($server_msg)) {
$server_msg = (string) $dbi->getError();
}
// Finding the query that failed, if not specified.
if (empty($sql_query) && ! empty($GLOBALS['sql_query'])) {
$sql_query = $GLOBALS['sql_query'];
}
$sql_query = trim($sql_query);
/**
* The lexer used for analysis.
*
* @var Lexer $lexer
*/
$lexer = new Lexer($sql_query);
/**
* The parser used for analysis.
*
* @var Parser $parser
*/
$parser = new Parser($lexer->list);
/**
* The errors found by the lexer and the parser.
*
* @var array $errors
*/
$errors = ParserError::get(
[
$lexer,
$parser,
]
);
if (empty($sql_query)) {
$formatted_sql = '';
} elseif (count($errors)) {
$formatted_sql = htmlspecialchars($sql_query);
} else {
$formatted_sql = self::formatSql($sql_query, true);
}
$error_msg .= '';
$retval .= Sanitize::sanitizeMessage($message);
if (isset($GLOBALS['special_message'])) {
$retval .= Sanitize::sanitizeMessage($GLOBALS['special_message']);
unset($GLOBALS['special_message']);
}
$retval .= '
';
}
if ($render_sql) {
$query_too_big = false;
$queryLength = mb_strlen($sql_query);
if ($queryLength > $cfg['MaxCharactersInDisplayedSQL']) {
// when the query is large (for example an INSERT of binary
// data), the parser chokes; so avoid parsing the query
$query_too_big = true;
$query_base = mb_substr(
$sql_query,
0,
$cfg['MaxCharactersInDisplayedSQL']
) . '[...]';
} else {
$query_base = $sql_query;
}
// Html format the query to be displayed
// If we want to show some sql code it is easiest to create it here
/* SQL-Parser-Analyzer */
if (! empty($GLOBALS['show_as_php'])) {
$new_line = '\\n"' . "\n" . ' . "'; $query_base = htmlspecialchars(addslashes($query_base)); $query_base = preg_replace( '/((\015\012)|(\015)|(\012))/', $new_line, $query_base ); $query_base = '
' . "\n"
. '$sql = "' . $query_base . '";' . "\n"
. '' . "\n" .
htmlspecialchars($query_base, ENT_COMPAT) .
'';
$retval .= $query_base;
$retval .= '
';
$retval .= '';
$retval .= '';
/**
* TODO: Should we have $cfg['SQLQuery']['InlineEdit']?
*/
if (! empty($cfg['SQLQuery']['Edit'])
&& ! $query_too_big
&& empty($GLOBALS['show_as_php'])
) {
$inline_edit_link = ' [ '
. self::linkOrButton(
'#',
_pgettext('Inline edit query', 'Edit inline'),
['class' => 'inline_edit_sql']
)
. ' ]';
} else {
$inline_edit_link = '';
}
$retval .= $inline_edit_link . $edit_link . $explain_link . $php_link
. $refresh_link;
$retval .= '
';
$retval .= '' . __('Error') . '
'; // For security reasons, if the MySQL refuses the connection, the query // is hidden so no details are revealed. if (! empty($sql_query) && ! mb_strstr($sql_query, 'connect')) { // Static analysis errors. if (! empty($errors)) { $error_msg .= '' . __('Static analysis:') . '
'; $error_msg .= '' . sprintf( __('%d errors were found during analysis.'), count($errors) ) . '
'; $error_msg .= '- ';
$error_msg .= implode(
ParserError::format(
$errors,
'
- %2$s (near "%4$s" at position %5$d) ' ) ); $error_msg .= '
' . __('SQL query:') . '' . self::showCopyToClipboard( $sql_query ) . "\n"; $formattedSqlToLower = mb_strtolower($formatted_sql); // TODO: Show documentation for all statement types. if (mb_strstr($formattedSqlToLower, 'select')) { // please show me help to the error on select $error_msg .= MySQLDocumentation::show('SELECT'); } if ($is_modify_link) { $_url_params = [ 'sql_query' => $sql_query, 'show_query' => 1, ]; if (strlen($table) > 0) { $_url_params['db'] = $db; $_url_params['table'] = $table; $doedit_goto = ''; } elseif (strlen($db) > 0) { $_url_params['db'] = $db; $doedit_goto = ''; } else { $doedit_goto = ''; } $error_msg .= $doedit_goto . self::getIcon('b_edit', __('Edit')) . ''; } $error_msg .= '
' . "\n" . '' . "\n" . $formatted_sql . "\n" . '
' . "\n"; } // Display server's error. if (! empty($server_msg)) { $server_msg = (string) preg_replace( "@((\015\012)|(\015)|(\012)){3,}@", "\n\n", (string) $server_msg ); // Adds a link to MySQL documentation. $error_msg .= '' . "\n" . ' ' . __('MySQL said: ') . '' . MySQLDocumentation::show('server-error-reference') . "\n" . '
' . "\n"; // The error message will be displayed within a CODE segment. // To preserve original formatting, but allow word-wrapping, // a couple of replacements are done. // All non-single blanks and TAB-characters are replaced with their // HTML-counterpart $server_msg = str_replace( [ ' ', "\t", ], [ ' ', ' ', ], $server_msg ); // Replace line breaks $server_msg = nl2br($server_msg); $error_msg .= '' . $server_msg . ''; } $error_msg .= '
';
return sprintf($template, $title, $alt, $attr_str);
}
/**
* Displays a link, or a link with code to trigger POST request.
*
* POST is used in following cases:
*
* - URL is too long
* - URL components are over Suhosin limits
* - There is SQL query in the parameters
*
* @param string $url the URL
* @param string $message the link message
* @param mixed $tag_params string: js confirmation; array: additional tag
* params (f.e. style="")
* @param string $target target
*
* @return string the results to be echoed or saved in an array
*/
public static function linkOrButton(
$url,
$message,
$tag_params = [],
$target = ''
): string {
$url_length = strlen($url);
if (! is_array($tag_params)) {
$tmp = $tag_params;
$tag_params = [];
if (! empty($tmp)) {
$tag_params['onclick'] = 'return Functions.confirmLink(this, \''
. Sanitize::escapeJsString($tmp) . '\')';
}
unset($tmp);
}
if (! empty($target)) {
$tag_params['target'] = $target;
if ($target === '_blank' && strncmp($url, 'url.php?', 8) == 0) {
$tag_params['rel'] = 'noopener noreferrer';
}
}
// Suhosin: Check that each query parameter is not above maximum
$in_suhosin_limits = true;
if ($url_length <= $GLOBALS['cfg']['LinkLengthLimit']) {
$suhosin_get_MaxValueLength = ini_get('suhosin.get.max_value_length');
if ($suhosin_get_MaxValueLength) {
$query_parts = Util::splitURLQuery($url);
foreach ($query_parts as $query_pair) {
if (strpos($query_pair, '=') === false) {
continue;
}
[, $eachval] = explode('=', $query_pair);
if (strlen($eachval) > $suhosin_get_MaxValueLength) {
$in_suhosin_limits = false;
break;
}
}
}
}
$tag_params_strings = [];
if (($url_length > $GLOBALS['cfg']['LinkLengthLimit'])
|| ! $in_suhosin_limits
// Has as sql_query without a signature
|| (strpos($url, 'sql_query=') !== false && strpos($url, 'sql_signature=') === false)
|| strpos($url, 'view[as]=') !== false
) {
$parts = explode('?', $url, 2);
/*
* The data-post indicates that client should do POST
* this is handled in js/ajax.js
*/
$tag_params_strings[] = 'data-post="' . ($parts[1] ?? '') . '"';
$url = $parts[0];
if (array_key_exists('class', $tag_params)
&& strpos($tag_params['class'], 'create_view') !== false
) {
$url .= '?' . explode('&', $parts[1], 2)[0];
}
}
foreach ($tag_params as $par_name => $par_value) {
$tag_params_strings[] = $par_name . '="' . htmlspecialchars($par_value) . '"';
}
// no whitespace within an else Safari will make it part of the link
return ''
. $message . '';
}
/**
* Prepare navigation for a list
*
* @param int $count number of elements in the list
* @param int $pos current position in the list
* @param array $_url_params url parameters
* @param string $script script name for form target
* @param string $frame target frame
* @param int $max_count maximum number of elements to display from
* the list
* @param string $name the name for the request parameter
* @param string[] $classes additional classes for the container
*
* @return string the html content
*
* @access public
*
* @todo use $pos from $_url_params
*/
public static function getListNavigator(
$count,
$pos,
array $_url_params,
$script,
$frame,
$max_count,
$name = 'pos',
$classes = []
): string {
// This is often coming from $cfg['MaxTableList'] and
// people sometimes set it to empty string
$max_count = intval($max_count);
if ($max_count <= 0) {
$max_count = 250;
}
$class = $frame === 'frame_navigation' ? ' class="ajax"' : '';
$list_navigator_html = '';
if ($max_count < $count) {
$classes[] = 'pageselector';
$list_navigator_html .= '';
if ($frame !== 'frame_navigation') {
$list_navigator_html .= __('Page number:');
}
// Move to the beginning or to the previous page
if ($pos > 0) {
$caption1 = '';
$caption2 = '';
if (Util::showIcons('TableNavigationLinksMode')) {
$caption1 .= '<< ';
$caption2 .= '< ';
}
if (Util::showText('TableNavigationLinksMode')) {
$caption1 .= _pgettext('First page', 'Begin');
$caption2 .= _pgettext('Previous page', 'Previous');
}
$title1 = ' title="' . _pgettext('First page', 'Begin') . '"';
$title2 = ' title="' . _pgettext('Previous page', 'Previous') . '"';
$_url_params[$name] = 0;
$list_navigator_html .= '' . $caption1
. '';
$_url_params[$name] = $pos - $max_count;
$list_navigator_html .= ' '
. $caption2 . '';
}
$list_navigator_html .= '';
if ($pos + $max_count < $count) {
$caption3 = '';
$caption4 = '';
if (Util::showText('TableNavigationLinksMode')) {
$caption3 .= _pgettext('Next page', 'Next');
$caption4 .= _pgettext('Last page', 'End');
}
if (Util::showIcons('TableNavigationLinksMode')) {
$caption3 .= ' >';
$caption4 .= ' >>';
}
$title3 = ' title="' . _pgettext('Next page', 'Next') . '"';
$title4 = ' title="' . _pgettext('Last page', 'End') . '"';
$_url_params[$name] = $pos + $max_count;
$list_navigator_html .= '' . $caption3
. '';
$_url_params[$name] = floor($count / $max_count) * $max_count;
if ($_url_params[$name] == $count) {
$_url_params[$name] = $count - $max_count;
}
$list_navigator_html .= ' '
. $caption4 . '';
}
$list_navigator_html .= '
' . "\n";
}
return $list_navigator_html;
}
/**
* format sql strings
*
* @param string $sqlQuery raw SQL string
* @param bool $truncate truncate the query if it is too long
*
* @return string the formatted sql
*
* @global array $cfg the configuration array
*
* @access public
*/
public static function formatSql($sqlQuery, $truncate = false): string
{
global $cfg;
if ($truncate
&& mb_strlen($sqlQuery) > $cfg['MaxCharactersInDisplayedSQL']
) {
$sqlQuery = mb_substr(
$sqlQuery,
0,
$cfg['MaxCharactersInDisplayedSQL']
) . '[...]';
}
return '' . "\n"
. htmlspecialchars($sqlQuery, ENT_COMPAT) . "\n"
. '